[codex] make CLI auth token script-safe

[ebarroca]

Summary

• Make vertesia auth token safe for command substitution by printing only a valid token or exiting nonzero with an error on stderr.
• Add VERTESIA_PROFILE support for selecting a profile without changing the saved default.
• Split token material out of profiles.json into private ~/.vertesia/tokens/<profile>.json files, with backward compatibility for existing inline apikey profiles.
• Redact token material from profiles show output.

Root Cause

When a stored CLI token was expired, vertesia auth token printed status text to stdout and entered the interactive browser-refresh flow. Inside TOKEN="$(vertesia auth token)", stdout is captured and the parent shell waits for the child process, so users see an apparent hang before curl --max-time can run.

Impact

Scripts can now safely use TOKEN="$(vertesia auth token)": valid tokens are emitted to stdout; missing, malformed, or expired tokens fail fast and tell the user to run vertesia auth refresh.

Validation

• pnpm --prefix packages/cli build
• Smoke-tested auth token with a temporary HOME: expired default profile exits 1; VERTESIA_PROFILE=valid prints the selected token.